Recently my server logged multiple ID 157 events texting “Disk # has been surprise removed”.
Check the disk number! If it is larger than the disks that you have (minus 1, since we start counting from 0), then it is safe to ignore it.
You receive “Disk 2 has been surprise removed” and you know that you have only two disks. Here is the diskpart list disk command output:
DISKPART> list disk
Disk ### Status Size Free Dyn Gpt
——– ————- ——- ——- — —
Disk 0 Online 127 GB 0 B
Disk 1 Online 2048 GB 0 B *
In such case the most probable answer was proposed from Tom here, as well as mind backed up from others here. It looks like when backing up a virtual machine the VSS shadow copy is mounted as additional drive – so far nothing new; ever since VSS was presented this worked without these event logs – but Tom suggests it is mounted as vdhx, hence the warning during unmount.
I wonder if Windows Backup is creating a snapshot aka checkpoint of the virtual machine and then using the vhdx file from the Hyper-V.